Email header guides
Everything you need to read a message's headers yourself: where to find them, what each field records, how authentication works, and the tricks phishers use. Each guide cites the RFC sections it's based on.
Find the headers
Where each mail app hides the full headers, and how to copy them.
How to view full email headersEvery major mail app hides the raw headers behind a menu item with a different name. Here is where each one keeps them and what to copy.
View full headers in GmailIn Gmail on the web, open the message, click the three-dot More menu next to Reply and choose Show original. The Gmail phone apps don't offer it.
View full headers in OutlookNew Outlook and Outlook on the web: More actions → View → View message details. Classic Outlook for Windows: File → Properties → Internet headers.
View full headers in Apple MailIn Mail on Mac choose View → Message → All Headers. On iCloud.com open the message, click More and choose Show All Headers.
View full headers in ThunderbirdPress Ctrl+U (Cmd+U on Mac) or use View → Message Source to see the raw message. View → Headers → All shows every header above the message.
View full headers in Yahoo Mail and AOL MailIn Yahoo Mail on the web, open the message, click the More (three dots) icon and choose View Raw Message. AOL Mail works the same way.
View full headers on a phoneiPhone Mail, the Gmail app and the Outlook app don't show full headers. Use webmail in a browser, a computer, or forward the message as an attachment.
Read the fields
What each header field records, who wrote it, and how far to trust it.
How to read Received headersReceived headers are the message's travel log, newest on top. Read them from the bottom, and trust only the hops added by servers you trust.
SMTP protocol keywords in Received headersThe word after "with" in a Received line names the protocol for that one hop: S means TLS, A means the client logged in. It says nothing about the other hops.
The Message-ID headerMessage-ID is a unique tag created by the sending software. Its domain hints at which system built the message, but it's unauthenticated and easy to fake.
Encoded-words (=?UTF-8?B?…?=)Strings like =?UTF-8?B?…?= are RFC 2047 encoded-words: a way to carry non-ASCII text in headers. Easy to decode, and sometimes used to hide text from filters.
The Return-Path headerReturn-Path is the bounce address from the SMTP envelope. It often differs from From for legitimate bulk mail; what matters is whether SPF passed and aligned.
The Reply-To headerReply-To redirects your answer to a different address than From. Normal for lists and help desks; a classic sign of invoice and CEO fraud when it points somewhere unrelated.
The Authentication-Results headerAuthentication-Results is your provider's verdict on SPF, DKIM and DMARC. Learn to read each part, and trust only the copy your own provider added.
The Received-SPF headerReceived-SPF records one server's SPF check in enough detail to repeat it: which IP, which domain, which rule matched. Trust only the one your provider added.
The DKIM-Signature headerA DKIM-Signature is a domain's cryptographic stamp on a message. d= says who signed, s= which key, h= which headers are protected. Here's every tag.
The Date headerThe Date header is the time the sender's software says the message was written. It's set by the sender, so compare it with the first trustworthy Received timestamp.
SPF, DKIM, DMARC and ARC
The four checks that decide whether a From address is genuine.
SPF explainedWhat SPF actually authenticates (the envelope sender, not the From line you see), how a record is evaluated, the seven results, the 10-lookup limit and why forwarded mail fails.
DKIM explainedHow a DKIM signature is built (d=, s=, bh=, b=), what canonicalization tolerates, what a pass really proves about the sender, why lists and footers break signatures, and how keys rotate.
DMARC explainedDMARC is the check that links authentication to the visible From domain. The record and its tags, how receivers evaluate and apply it, the five results, and what a fail under p=none means for you.
DMARC alignmentWhat 'aligned' means in DMARC, how the organizational domain is found (DNS Tree Walk now, Public Suffix List before), relaxed versus strict mode, and worked examples including email service providers.
ARC explainedHow the Authenticated Received Chain records authentication results across intermediaries, how to read ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results, and why a valid chain only matters if the receiver trusts the sealer.
Spot a fake
Phishing and impersonation tricks, and the header evidence that gives them away.
Spotting phishing from the headersA checklist in order of usefulness for judging a suspicious email from its headers, an annotated spoof example, the limits of what headers can tell you, and what to do next.
Display name spoofingWhy the name shown next to a message proves nothing, the common tricks (fake role names, an email address inside the name, mobile clients hiding the address), the business email compromise pattern, and how to check a sender.
Look-alike domainsThe families of look-alike domains used in phishing, how internationalized domains and punycode enable homograph attacks, why authentication still passes for them, and how the analyser detects them.
Delivery and delays
Slow mail, forwarding, mailing lists and unsubscribe headers.
Why is my email delayed?How to measure the delay between each Received hop, a worked example with time zones, and the usual causes: greylisting, sender queues, spam filtering, outages, clock skew and Date headers set long before sending.
Forwarding and mailing listsWhy plain forwarding breaks SPF (and how SRS works around it), why mailing lists break DKIM and DMARC, why lists rewrite the From line ('via'), where ARC fits, and how each case looks in the headers.
List-Unsubscribe headersHow the List-Unsubscribe (RFC 2369) and one-click List-Unsubscribe-Post (RFC 8058) headers work, mailto versus https, why link scanners made the POST form necessary, the 2024 Gmail and Yahoo requirements, and safe unsubscribing.